Insights
Research, analysis, and perspectives on cybersecurity, AI security, and financial sector protection.
What is the real cost of a data breach in Brazil?
The cost of a data breach goes far beyond the technical fix: slow detection, LGPD sanctions, response and reputational damage. Understand the drivers.
Read articleVulnerability management vs. pentest
Vulnerability management delivers breadth and continuity; a pentest proves depth and impact. See the differences, the cadence and how to combine them.
Read articleISO 42001 and the EU AI Act: compliance guide
ISO/IEC 42001 defines the AI management system; the EU AI Act sets obligations by risk level. How the two relate and the practical path to compliance.
Read articlePCI MPoC: what it is and who needs it
PCI MPoC is the standard that turns an ordinary smartphone into a payment terminal. See how it differs from SPoC and CPoC and who needs it in Brazil.
Read articleWhat is AI pentesting? How it works, when to do it
AI pentesting explained: what it is, how it works phase by phase, when to do it, and how the OWASP LLM Top 10 2025 applies to chatbots, agents and RAG.
Read articleWhat is prompt injection? Types and defenses
Prompt injection: definition, direct vs. indirect, examples in chatbots, agents and RAG, why it is OWASP LLM01 and which defenses actually work.
Read articleWhat is Red Team? Adversary simulation guide
Red Team is the end-to-end simulation of a real adversary, run to test not only an organization's flaws but its ability to detect and respond.
Read articleAgentic pentest with Berghem Agents: how it works
Agentic pentest uses AI agents that pursue an objective, chain flaws, and keep the specialist in control. How it works and where its limits are.
Read articlePentest and BACEN compliance: CMN 4.893 and BCB 85
BACEN rules require a cybersecurity policy, incident response and an annual independent pentest. How the test yields the evidence the regulator expects.
Read articleSOC and MDR as a service: when it makes sense
When to buy SOC and MDR as a service instead of building an internal team, how to compare options and what to demand of a detection and response provider.
Read articlePromptware Kill Chain: attacking AI systems
Prompt injection is only the initial access. Our seven-stage framework to test AI systems end-to-end and map real 2025–2026 incidents.
Read articleOWASP LLM Top 10: practical guide
The ten OWASP LLM categories: what each means in practice and how to test them with reproducible evidence.
Read articleMITRE ATLAS vs. ATT&CK: mapping AI attacks
ATT&CK describes the adversary in the infrastructure; ATLAS what they do to the model. How we cross-reference both in AI pentest.
Read articleFrom DGX Spark to 8x B200: How I Prototyped Locally and Trained a 4B Mamba-2 Model for €118
A practical journey from local prototyping on NVIDIA DGX Spark to training a 4-billion parameter Mamba-2 language model using 8x B200 GPUs on cloud infrastructure — all for just €118.
Read on Medium